DE102015107718B4 - Device and method for securing an electrical system component of a vehicle electrical system - Google Patents

Abstract

Device (1) for protecting at least one safety-relevant electrical system component (2, 3) of a vehicle electrical system, comprising: - at least one semiconductor switch (4) which is electrically conductively connected to the at least one electrical system component (2, 3) - A circuit (8) which is electrically conductively connected to the semiconductor switch (4) and which has a detection device (9) for detecting an electrical malfunction of the vehicle electrical system and a control device (14) for controlling the semiconductor switch (4), and - a control unit (20) which is connected at least to the circuit (8) capable of communication, characterized in that the device (1) is set up to convert the semiconductor switch (4) into one depending on the detection of a predetermined electrical malfunction first safety state, in which the semiconductor switch (4) is switched off, to switch to the electrical system component (2, 3) from electrical To protect overloads, and furthermore, depending on a transient second electrical malfunction and at least one predetermined vehicle state, to switch to a second safety state in which the semiconductor switch (4) is switched on in order to ensure an availability-relevant supply of the on-board electrical system components (2, 3) ensure, and further that the circuit (8) has a malfunction shutdown device (19) which is set up to forcibly switch the semiconductor switch (4) temporarily for about 50 microseconds to about 150 microseconds into the first safety state depending on the detection of a third electrical malfunction.

Description

Technical area

The present invention relates to a device for protecting at least one electrical system component of a vehicle electrical system, in particular an electrical electrical system or energy electrical system of a motor, hybrid or electric vehicle. The invention also relates to a method for protecting at least one on-board network component of such a vehicle on-board network.

State of the art

Vehicle electrical systems are known from practice which are used to supply a large number of electrical consumers or loads with electrical energy. To switch these loads, for example, semiconductor switches can be used as so-called high-side switches, which optionally supply the respective loads with electrical energy or switch them off.

Furthermore, it is known from practice that electrical overcurrents can occur as electrical malfunctions in a vehicle electrical system, which are caused, for example, by an overload or an electrical short circuit. In the case of short circuits, for example, an undesired electrical connection between a voltage-carrying electrical line and ground or an undesired electrical connection between two electrical lines carrying an electrical voltage can occur sporadically or permanently and in different forms. In any case, it is necessary for the functional reliability of a vehicle to protect the vehicle electrical system against undesired electrical overcurrents and / or short circuits. This is intended in particular to ensure protection against thermal overload.

If protection against thermal overload is a safety goal in accordance with functional safety, the residual error probability that this safety goal will not be achieved by the device must not be higher than a specified metric (e.g. 100 Fit, Error in Time). The safety concept required for this includes a degree of diagnostic coverage of e.g. at least 90%. Latent errors, which can lead to a thermal overload not being detected and switched off, must therefore be recognized to 90% before damage occurs, e.g. due to a short circuit. If the diagnosis detects that, for example, the short-circuit detection is not working, then there is a latent error. The error is latent because, in addition to the failure of the short-circuit detection, the occurrence of a short-circuit must also occur in order for a damage case to occur. If the diagnosis detects a (latent) error, the device must be brought into a predefined, safe state. As an example, the safe state OFF (switching off the load path) is for the safety goal of protection against thermal overload.

It is therefore usually necessary for numerous vehicle functions that they are switched to a kind of “emergency stop” as a safety state to be assumed when such an electrical malfunction occurs, in order to meet the safety requirements for a vehicle. For example, an anti-lock braking system in which there is an electrical malfunction is switched off for (driving) safety and this is signaled to the vehicle driver. In the event of a fault, a common safety condition for vehicle functions is the forced shutdown of the respective vehicle function.

In connection with more extensive vehicle functions, such as those implemented for autonomous driving and / or so-called drive-by-wire systems of a vehicle, it has proven to be noteworthy that the availability-relevant supply of safety-critical functions is added as a new safety goal. Diagnostic coverage must also be implemented for this safety goal. The diagnosis should recognize whether the availability-relevant supply is threatened by (latent) errors in the system. If such (latent) errors are detected, the safe state must be adopted and in this case it is ON or at least ON until the vehicle can be safely parked and the availability-relevant function can be switched off.

the DE 10 2011 100 392 A1 describes a circuit arrangement for monitoring a safety circuit. the DE 10 2009 039 504 A1 describes a method for fault detection in a drive train. the DE 10 2006 016 454 A1 discloses a method for operating an on-board electrical system of a motor vehicle with a fuel cell. the DE 10 2004 057 828 A1 describes a device for the emergency shutdown of electrical power supply circuits in a motor vehicle. Of the DE 199 64 097 A1 a protective circuit for an electronic unit against prolonged overvoltage can be found. the DE 100 40 246 A1 describes a device for controlling at least one consumer.

For a device for protecting an on-board network component, the challenge now arises that the two safety goals are protection against thermal overload and the availability-relevant supply of safety-critical functions are to be fulfilled at the same time. If the diagnosis linked to the protection against thermal overload safety goal now detects a latent error (error in short-circuit detection), the system would have to be switched to the safe OFF state (even if there is no short-circuit yet). The safe state OFF of the first safety goal is at the same time the unsafe state of the second safety goal, the availability-relevant supply of safety-critical functions and thus leads to the violation of the second safety goal.

In the case of autonomous driving, for example, it is understandable that a forced shutdown of a (driving) safety-relevant vehicle function based on the detection of a latent error in the context of a diagnosis is not desired. Rather, in the case of such vehicle functions, it is desirable that an availability-relevant supply of the vehicle function, for example an electrical consumer or an electrical load, continues to take place reliably with electrical energy. In the case of such vehicle functions, a common safety condition is maintaining the power supply in order to prevent it from being switched off.

This results in a conflict of objectives in the two opposing safety states, namely between switching off and maintaining the energy supply. There is therefore a desire to find a solution to this conflict of objectives.

Description of the invention

The object of the invention is therefore to use means that are as simple as possible to create a way of protecting an on-board network component, with which the functional reliability of the on-board network component is improved.

This object is achieved by the subjects with the features of the independent claims. Advantageous further developments of the invention are specified in the subclaims, the following description and the figures.

The device according to the invention for protecting at least one on-board network component of a vehicle on-board network comprises at least one semiconductor switch which is electrically conductively connected to the at least one on-board network component. In addition, the device has a circuit which is electrically conductively connected to the semiconductor switch and which has a detection device for detecting, in particular, an electrical malfunction of the vehicle electrical system and a control device for controlling the semiconductor switch. Furthermore, the device has a control unit which is connected at least to the circuit in a manner capable of communication. According to the invention, the device is set up to switch the semiconductor switch to a first safety state in which the semiconductor switch is switched off as a function of the detection of a particular electrical malfunction, and also to switch the semiconductor switch to the first safety state as a function of at least one predetermined vehicle state, preferably by the control unit or to switch to a second safety state in which the semiconductor switch is switched on.

In other words, the device according to the invention for protecting at least one on-board network component of a vehicle on-board network is configured to resolve a conflict of objectives between safety states that have hitherto been mutually exclusive. Namely between, on the one hand, the first security state, which serves in particular, but not exclusively, to protect the on-board network component from an electrical malfunction, and, on the other hand, the second security state, which in particular is an availability-relevant one The on-board network component is supplied with electrical energy. The device according to the invention functions exclusively electrically and / or electronically and manages without an additional, mechanical back-up system, so that it is particularly suitable for so-called drive-by-wire concepts and autonomous driving of a vehicle.

The vehicle electrical system can comprise a large number of different electrical and / or electronic components or assemblies as well as electrical lines as vehicle electrical system components. The device is set up to protect one, two or more components of the vehicle electrical system, in particular also at the same time. In the simplest case, the vehicle electrical system component to be protected can be, for example, an electrical line of the vehicle electrical system that is intended to be protected against an electrical or thermal overload or an electrical overcurrent. The electrical line can be arranged in a cable harness of the vehicle electrical system. In addition, the electrical system component can in principle be any electrical or electronic consumer, any electrical load, an actuator, sensor, control device or the like of a vehicle electrical system, provided that this electrical system component is to be protected against malfunction. In particular, the electrical system component can directly or indirectly take over a safety-relevant (driving) function for the vehicle equipped with it, such as electrical steering, braking, autonomous driving or the like, so that an availability-relevant supply of electrical energy to the electrical system component is ensured for this target.

The semiconductor switch can, for example, be a field effect transistor (FET for short), preferably a metal oxide semiconductor field effect transistor (MOSFET for short), particularly preferably an n-type MOSFET. The use of such semiconductor switches is distinguished from conventional switching elements such as relays and the additional protection required by means of fuses due to comparatively fast switching operations with simultaneous protection. In addition, a comparatively simple measurement of an electrical current connected to it is possible for intelligent energy management, an essentially freely configured protection of connected electrical lines via configurable fuse characteristics, a possible reduction of a line cross-section and a largely decentralized current distribution in inaccessible installation spaces of a vehicle, possibly directly possible in the respective cable set.

The electrical malfunction can be, for example, an electrical and / or thermal overload or an electrical overcurrent. Such an electrical malfunction can occur, for example, as a result of (also hard) short circuits within the vehicle electrical system. The malfunction can in particular be transient, that is to say temporary and not permanent, or occur sporadically.

A circuit can be understood as a unit or assembly of an electrical or electronic circuit which fulfills the function defined according to the invention. A communication-capable connection between control unit and circuit can be understood to mean any type of physical information transmission between control unit and circuit, for example information transmission via an electrical line, a data line, a data bus or the like. It has proven to be advantageous if the circuit has a bus system, in particular what is known as a serial peripheral interface (SPI for short).

The control unit can be designed and / or arranged separately from the circuit. Alternatively, the control unit can also be integrated into the circuit.

The vehicle state to be taken into account can be selected from a multiplicity of predetermined vehicle states. For example, this can be a wake-up phase of a vehicle, a switched plus or ignition plus (“Terminal 15 on”) and / or an active driving cycle of the vehicle.

With this configuration, the device according to the invention advantageously enables, on the one hand, a safeguarding of an on-board network component against, in particular, transient electrical overloads. On the other hand, however, an availability-relevant supply of electrical energy to the on-board network component is at least not permanently interrupted because of an individual fault. Without the configuration according to the invention for safeguarding an on-board network component, two semiconductor switches would otherwise have to be connected in series for a functionally reliable shutdown in the event of an electrical overload, for example, and two semiconductor switches would have to be connected in parallel again for the availability-relevant supply of an on-board network component. This means that a serial redundancy for protection against an electrical malfunction and an additional, parallel redundancy for the availability-relevant supply would have to be provided. This is not desirable for reasons of cost and the limited space available in a vehicle and a comparatively high power loss. The configuration according to the invention is thus characterized by a particularly simple structurally simple option for protecting an on-board network component, with which the functional reliability of the on-board network component is improved.

A particularly advantageous development of the invention provides that the first safety state or the second safety state are prioritized by the control unit as a function of the at least one vehicle state. In other words, the safety state to be switched can in principle be specified at any time by a (control) entity superordinate to the circuit and can be changed as a function of a respective vehicle state and / or state of the vehicle electrical system. In contrast to the state of the art, the safety state to be switched is therefore not fixed in an unchangeable manner, but can be adapted to a particular vehicle state.

For the most effective possible protection of the semiconductor switch from damage, it can be advantageous if the circuit has a malfunction shutdown device that at least temporarily forcibly switches the semiconductor switch to the first safety state depending on the detection of an electrical malfunction. The period of time for this forced shutdown can be, for example, about 50 to 150 μS, preferably about 100 μS. The malfunction disconnection device can be arranged for the fastest possible disconnection of the semiconductor switch in terms of time so that it switches the semiconductor switch in a direct manner without for example to integrate the control unit. Ideally, it can also be provided that the forced shutdown is always active, in particular depending on the severity of the electrical malfunction and / or depending on the vehicle function to be fulfilled. In this way, the semiconductor switch can be switched off quickly in the event of an electrical malfunction in order to avoid electrically or thermally induced damage to the semiconductor switch and possibly also to the electrical system components connected to it in an electrically conductive manner.

Another advantageous development of the invention provides that the device is set up to optionally replace, superimpose or override or the like a control signal of the circuit by in particular a control signal of the control unit in order to forcibly switch the semiconductor switch to the second safety state. By optionally replacing the control signal of the circuit, in particular with a control signal from the control unit, it is possible in a particularly simple manner to switch the semiconductor switch to the first safety state as a function of the electrical malfunction as well as to the first safety state or the second as a function of the at least one vehicle state To switch safety state. This means that despite the switching of the semiconductor switch to the first safety state by the circuit, for example by the control device and / or the malfunction shutdown device, it is still possible to switch to the second safety state either instead or afterwards.

An electrical malfunction can be detected in a particularly reliable and structurally simple manner if the device, in particular the detection device, is set up _{to detect a voltage drop U DS-On} at the semiconductor switch. The device can preferably be set up to detect or measure a voltage drop at or across the drain-source resistance of the semiconductor switch, for example a MOSFET, in particular in the switched-on state. For this purpose, the device, in particular the detection device, can comprise a type of measuring bridge circuit, the first branch of which is electrically connected to a drain connection of the semiconductor switch and the second branch of which is electrically connected to a source connection of the semiconductor switch. This detectable voltage drop is proportional to the electric current to be switched by the semiconductor switch, so that in this way an indirect detection of the electric current to determine an electrical malfunction, for example an electrical overcurrent, is possible.

For the simplest possible evaluation or determination of whether there is an electrical malfunction, it has proven to be advantageous if the detection device comprises a differential amplifier and an evaluation unit fed by it for detecting an electrical malfunction. The differential amplifier can also be a comparator which compares two electrical voltages with one another. An analog-digital converter, for example, which converts the analog voltage signal into a digital signal, is suitable as an evaluation unit. Thus, the voltage drop across the drain-source resistance of the semiconductor switch can be fed to the differential amplifier and subsequently to the analog-digital converter. The digital signal can be evaluated comparatively easily, for example by the control unit. For the evaluation, for example, a software filter can be provided that can be adapted comparatively flexibly to the most varied of vehicle types and their requirements with regard to the protection of the respective vehicle electrical system.

For the fastest possible control of the semiconductor switch in terms of time, it can be advantageous if the circuit, in particular the control device, includes a gate driver. In addition, the circuit, in particular the control device, can include a charge pump for generating a specific gate voltage.

For a device that is as small as possible and, in particular, comparatively inexpensive provision of the device in the case of large quantities, it can be advantageous if the circuit is an integrated circuit, in particular an ASIC that is an application-specific integrated circuit.

It has proven to be advantageous if the control unit is a microcontroller which is set up to determine a large number of vehicle states. To determine a respective vehicle state, the control unit can be connected to a vehicle bus, such as a LIN or CAN bus, in a manner capable of communication. The microcontroller can be, for example, a battery management system, for example a battery control device or another vehicle control device.

• - Vorsehen beziehungsweise Bereitstellen von wenigstens einem Halbleiterschalter, der mit der wenigstens einen Bordnetz-Komponente elektrisch leitfähig verbunden ist.
• - Vorsehen beziehungsweise Bereitstellen von einem Schaltkreis, der mit dem Halbleiterschalter elektrisch leitfähig verbunden ist und der eine Erfassungseinrichtung zur Erfassung einer elektrischen Fehlfunktion des Fahrzeug-Bordnetzes sowie eine Ansteuereinrichtung zum Ansteuern des Halbleiterschalters aufweist.
• - Vorsehen beziehungsweise Bereitstellen von einer Steuereinheit, die zumindest mit dem Schaltkreis kommunikationsfähig verbunden ist.

The invention also relates to a method for protecting at least one electrical system component of a vehicle electrical system. This procedure consists of the following steps:

• - Providing or providing at least one semiconductor switch, which is connected to the at least one electrical system component in an electrically conductive manner.
• - Providing or providing a circuit which is electrically conductively connected to the semiconductor switch and which has a detection device for detecting an electrical malfunction of the vehicle electrical system and a control device for controlling the semiconductor switch.
• - Provision or provision of a control unit which is connected at least to the circuit in a manner capable of communication.

According to the invention, depending on the detection of an electrical malfunction, the semiconductor switch is switched to a first safety state in which the semiconductor switch is switched off, and furthermore, depending on at least one predetermined vehicle state, preferably by the control unit, it is optionally switched to the first safety state or to a second safety state, in which the semiconductor switch is switched on.

For the method according to the invention, all features of the device described above for protecting at least one on-board network component of a vehicle on-board network can be used accordingly.

A particularly advantageous development of the invention provides that the first safety state or the second safety state can be prioritized by the control unit as a function of the at least one vehicle state. Accordingly, the control unit can preferably replace, superimpose or override or the like an output signal of the switching circuit in order to forcibly switch a specific, possibly prioritized safety state. In other words, the safety state to be switched is in principle specified at any time by a (control) entity superordinate to the circuit and can be changed as a function of a respective vehicle state and / or state of the vehicle electrical system.

For the best possible protection against damage to the semiconductor switch, it can be provided that the semiconductor switch is forcibly switched to the first safety state at least temporarily as a function of the detection of an electrical malfunction. For this purpose, it can be advantageous if the circuit has a malfunction disconnection device by means of which the semiconductor switch is forcibly switched to the first safety state at least temporarily as a function of the detection of an electrical malfunction. The malfunction disconnection device can be arranged to disconnect the semiconductor switch as quickly as possible in terms of time so that the semiconductor switch can be switched directly without, for example, involving the control unit.

For the highest possible functional reliability of the vehicle electrical system, it can be advantageous if, in the event of an electrical malfunction, there is always, that is, in any case, at least temporarily switched to the first safety state.

Another advantageous development of the invention provides that a control signal of the circuit can be optionally replaced, superimposed or the like by the control unit depending on the at least one predetermined vehicle state in order to forcibly switch the semiconductor switch to the second safety state at least temporarily. In this way, the semiconductor switch can nevertheless be switched to the second safety state at least temporarily even when an electrical malfunction is detected and / or present.

It can also be advantageous if, depending on the at least one vehicle state, the first safety state is switched to the second safety state at least once and the first safety state is only switched back to when the same electrical malfunction is detected again.

The invention can be used particularly advantageously in a vehicle, for example a motor vehicle or a hybrid or electric vehicle.

Figure list

• 1 ein schematisch dargestelltes Blockschaltbild einer erfindungsgemäßen Vorrichtung zum Absichern von wenigstens einer Bordnetz-Komponente eines Fahrzeug-Bordnetzes mit einem zu schaltenden Lastkanal und
• 2 das schematisch dargestellte Blockschaltbild einer erfindungsgemäßen Vorrichtung zum Absichern von wenigstens einer Bordnetz-Komponente eines Fahrzeug-Bordnetzes aus 1, wobei dieses um einen zu schaltenden Lastkanal erweitert ist.

Advantageous exemplary embodiments of the invention are explained below with reference to the accompanying figures. Show it:

• 1 a schematically represented block diagram of a device according to the invention for protecting at least one electrical system component of a vehicle electrical system with a load channel to be switched and
• 2 the schematically illustrated block diagram of a device according to the invention for protecting at least one electrical system component of a vehicle electrical system 1 , whereby this is extended by a load channel to be switched.

The figures are merely schematic representations and only serve to explain the invention. The same elements are provided with the same reference symbols throughout.

1 shows a device according to the invention in a schematically represented block diagram 1 to secure at least one On-board network component of a vehicle on-board network (only shown here in part). The vehicle electrical system is an electrical electrical system, a so-called energy electrical system of a motor vehicle.

The vehicle electrical system includes an electrical consumer or an electrical load 2 and an electrical line connected to it 3 . The by the device 1 On-board network components to be protected can, for example, be the electrical load 2 or the electrical line 3 or be both elements. In this exemplary embodiment, precisely one single load channel is shown as an example.

the end 1 shows that the device 1 a semiconductor switch 4th has, which is on the electrical line 3 with the electrical load 2 is electrically conductively connected. The semiconductor switch 4th is designed in this embodiment as a metal-oxide-semiconductor field effect transistor (MOSFET for short), in particular as an n-type MOSFET. As a result, the semiconductor switch has 4th via a drain connection 5 , a source connector 6th and a gate 7th or a gate connection. Such a semiconductor switch 4th In the switched-on state, it has a drain-source resistor R _DS-On , at which a detectable or measurable voltage drop U _DS-On occurs, which is proportional to an electric current to be detected here. The semiconductor switch 4th a first safety state in which the semiconductor switch 4th is locked or switched off, and assume a second safety state in which the semiconductor switch 4th is switched on.

The device also includes 1 a circuit 8th connected to the semiconductor switch via one or more electrical lines 4th is electrically conductively connected or, alternatively, forms an integral unit. In this embodiment, the circuit is 8th designed as an integrated circuit (IC for short), in particular as an application-specific integrated circuit (ASIC for short).

The circuit 8th has a detection device 9 for detecting an electrical malfunction of the vehicle electrical system, wherein the detection device 9 in this embodiment an arrangement with a first branch 10 and a second branch 11 for detecting or measuring the voltage drop U _{DS-On of} the semiconductor switch 4th includes. The first branch 10 is with the drain connector 5 , the second branch 11 is with the source connector 6th of the semiconductor switch 4th tied together. The circuit 8th further comprises a differential amplifier fed with the detected voltage drop U _DS-On 12th and an analog-to-digital converter fed by it 13th for converting the analog signal of the differential amplifier 12th into a digital signal.

The circuit 8th also has a control device 14th to control the semiconductor switch 4th on, which in this embodiment is essentially a gate driver 15th and a charge pump feeding it 16 includes.

The circuit also has 8th via an evaluation unit 17th with evaluation logic for (pre) evaluation of the data from the detection device 9 delivered signal. There is also a serial interface 18th provided, which is designed here as a so-called serial peripheral interface (SPI for short), for the communication-capable connection of the circuit 8th to other elements of the device 1 .

In 1 can also be seen that the circuit 8th a malfunction shutdown device 19th has, as a kind of quick shutdown for the semiconductor switch 4th works (quick shutdown for hard (transient) short circuits). The malfunction shutdown device is used for this 19th within the circuit 8th directly to the gate driver 15th or the charge pump 16 electrically conductively connected. The function of the malfunction shutdown device 19th is explained in more detail below.

The device 1 also has a control unit 20th on that via the serial interface 18th able to communicate with the circuit 8th connected is. the end 1 shows that the control unit 20th , which is an example of a battery management system with a vehicle bus system (indicated here as an arrow) 21 communicatively connected to receive, among other things, information about a respective vehicle state. In the control unit 20th a software filter is implemented, which is based on the by the detection device 9 and / or the evaluation unit 17th of the circuit 8th processed voltage drop U _DS-On across the semiconductor switch 4th an electrical malfunction is determined. The electrical malfunction can, for example, be an electrical overcurrent, that is to say an electrical current that exceeds the largest continuously permissible current as a result of short circuits or overload.

2 , which is also a schematically illustrated block diagram of the device according to the invention 1 shows is intended to illustrate that the device 1 is also able to secure more than one load channel, namely two, three, four or more load channels. The elements additionally required for this, however, correspond structurally and functionally to those of the above device 1 . For better The reference symbols of the elements that are used for the additional load channel to be protected are illustrated with the addition of the lowercase letter "a".

Based on 1 who have favourited the device 1 shows in a schematically illustrated block diagram, a possible operation of the device should now 1 or a method for securing at least one electrical system component of a vehicle electrical system are explained in more detail.

In general, the control unit controls 20th via the serial interface 18th whether the only load channel in this exemplary embodiment with the electrical load 2 should be switched on or off. The circuit 8th generated by the charge pump 16 the necessary gate voltage that goes through the gate driver 15th for controlling the semiconductor switch 4th on its gate 7th is switched through.

To during the operation of the vehicle or the device 1 the circuit detects or measures a possible electrical malfunction 8th _{the voltage drop U DS-On} across the semiconductor switch, which is proportional to the current to be detected 4th . For this purpose, the detected voltage drop U _{DS-On is sent to} the differential amplifier 12th fed. This in turn sends the signal obtained from it to the analog-digital converter 13th Further. After the analog-digital conversion of the signal from the differential amplifier 12th this is done via the evaluation logic of the (pre) evaluation unit 17 and the serial interface 18th to the control unit 20th forwarded or transmitted. In the control unit 20th the software filter is implemented, which, based on the (indirect) current measurement, identifies the load or overload situation as a possible electrical malfunction of the electrical line 3 and / or the electrical load 2 certainly.

The malfunction shutdown device is for hard short circuits 19th implemented as a kind of quick shutdown. This can be done directly, i.e. without the additional communication path via the control unit 20th In the event of hard, transient short circuits, the semiconductor switch is switched off immediately 4th make so as to the semiconductor switch 4th and / or the electrical load 2 to protect against damage.

Depending on the vehicle condition, for example via the control unit 20th and / or the associated vehicle bus is determined, the device can 1 now switch between the first safety state and the second safety state so that the safety state to be switched is variable or can be prioritized depending on the vehicle state.

By way of example, a prioritization of the first safety state and the second safety state that is sensible for the most functionally reliable vehicle operation can be carried out as described below.

The so-called wake-up phase of the vehicle comes into consideration as a possible vehicle state. It is provided here that the first safety state is prioritized and accordingly as the safety state to be assumed by the control unit 20th to the circuit 8th is given, that is, predetermined. In this wake-up phase of the vehicle, in particular a diagnosis is made with regard to an electrical malfunction and possibly a type of rapid shutdown by the malfunction shutdown device 19th . There is also a diagnosis of the activation of the semiconductor switch 4th .

During this wake-up phase, detected or diagnosed electrical malfunctions ensure that the semiconductor switch 4th remains switched off, i.e. remains in the first safety state, until the malfunction has been rectified. By a feedback of the device 1 , especially the control unit 20th For other vehicle functions, entry into a driving cycle or readiness to drive is prevented so that the vehicle cannot be put into (driving) operation. If, on the other hand, no electrical malfunction is detected or diagnosed, the device issues 1 , especially the control unit 20th a release to enter the driving cycle.

The prioritization is different in the exemplary vehicle state with switched plus ("Terminal 15 on") and the driving cycle already started. Because in this vehicle state, the second safety state has priority in the availability-relevant functions of the on-board network component and is accordingly controlled by the control unit 20th to the circuit 8th given.

Availability-relevant functions, such as drive-by-wire functions, should remain switched on in this vehicle state for (driving) safety reasons and must therefore continue to be reliably supplied with electrical energy. The detection or diagnosis of the electrical malfunction is still active. If an electrical malfunction is detected, a change is made to the second safety state (anyway) or an already switched second safety state is (anyway) retained. However, the malfunction is sent to the control unit 20th communicated and stored there. If an electrical malfunction does not exist (at least temporarily), the semiconductor switch remains 4th in the second safety state as long as no (transient) electrical overload is detected and the semiconductor switch 4th possibly by the malfunction shutdown device 19th is switched off quickly. The control unit 20th can decide, as a function of a control function stored therein, at what point in time or at what event a change is made to the first safety state.

To the semiconductor switch 4th but to protect against damage is the malfunction shutdown device 19th always active, since the semiconductor switch is switched off too slowly over time 4th this could be damaged. A hard short circuit or an internal fault, for example due to electromagnetic radiation, may be mentioned as possible electrical malfunctions. If the prioritization is now on the second safety state in which the semiconductor switch 4th is switched on and should remain, the semiconductor switch 4th briefly switched to the first safety state. The control unit 20th However, based on the prioritization of the second security state, it causes a rapid switchover (back) to the first security state. This can be done comparatively quickly, namely in about 50 to 150 microseconds, preferably in about 100 microseconds. Only if the electrical malfunction occurs again and the malfunction shutdown device 19th the semiconductor switch 4th (automatically) switches to the first security state, the first security state is permanently adopted and prioritized if necessary.

In this way, the semiconductor switch 4th as a function of the detection of an electrical malfunction, in particular by the malfunction shutdown device 19th be switched to the first safety state in which the semiconductor switch 4th (also forcibly) switched off.

Furthermore, a control signal of the malfunction shutdown device 19th but through the control unit 20th be replaced or superimposed depending on at least one predetermined vehicle state and thereby the semiconductor switch 4th optionally (anyway) switched to the second safety state in which the semiconductor switch 4th is switched on. This ensures that, on the one hand, the vehicle electrical system components and the semiconductor switch are protected quickly 4th takes place against a transient electrical overload, on the other hand, however, an availability-relevant supply of the on-board network component with electrical energy is not omitted because of a single fault.

Based on the illustrated embodiments, the device according to the invention 1 and the method according to the invention can be modified in many ways.

For example, it is conceivable that more than two vehicle states are predetermined and / or determined, which are prioritized differently. It is also not absolutely necessary that the circuit 8th is designed as an ASIC. It is also not absolutely necessary to use a software filter to evaluate a possible electrical malfunction. Rather, an electronic component can be provided for this, for example a flip-flop, a comparator or the like.

List of reference symbols

1

contraption

2, 2a

electrical consumer / electrical load

3, 3a

electrical line

4, 4a

Semiconductor switch

5, 5a

Drain connection

6, 6a

Source connector

7, 7a

Gate / Gate connection

8th

Circuit

9, 9a

Detection device

10, 10a

first branch

11, 11a

second branch

12, 12a

Differential amplifier

13th

Analog-to-digital converter

14, 14a

Control device

15, 15a

Gate driver

16, 16a

Charge pump

17th

Evaluation unit

18th

serial interface

19, 19a

Malfunction shutdown device

20th

Control unit

21

Vehicle bus system

Claims (13)

Device (1) for protecting at least one safety-relevant electrical system component (2, 3) of a vehicle electrical system, comprising: - at least one semiconductor switch (4) which is electrically conductively connected to the at least one electrical system component (2, 3) - A circuit (8) which is electrically conductively connected to the semiconductor switch (4) and which has a detection device (9) for detecting an electrical malfunction of the vehicle electrical system and a control device (14) for controlling the semiconductor switch (4), and - a control unit (20) which is at least connected to the circuit (8) so as to be able to communicate, characterized in that the device (1) is set up to put the semiconductor switch (4) in a first safety state as a function of the detection of a predetermined electrical malfunction , in which the semiconductor switch (4) is switched off, to switch to protect the electrical system components (2, 3) from electrical overloads, and further - depending on a transient second electrical malfunction and at least one predetermined vehicle state in a second safety state to switch, in which the semiconductor switch (4) is switched on in order to ensure an availability-relevant supply of the vehicle electrical system components (2, 3), and further that the circuit (8) has a malfunction shutdown device (19) which is set up to the semiconductor switch ( 4) depending on the detection of a third electrical malfunction ze Forced to switch to the first safety state for about 50 µs to about 150 µs. Device (1) according to Claim 1 , characterized in that the first safety state or the second safety state are prioritized by the control unit (20) as a function of the at least one vehicle state. Device (1) according to one of the preceding claims, characterized in that the device (1) is set up to optionally replace a control signal of the circuit (8) by the control unit (20) in order to put the semiconductor switch (4) in the second safety state forced to switch. Device (1) according to one of the preceding claims, characterized in that the detection device (9) is set up _{to detect a voltage drop (U DS-On} ) on the semiconductor switch (4). Device (1) according to one of the preceding claims, characterized in that the detection device (9) comprises a differential amplifier (12) and an evaluation unit (17) fed by it for the detection of an electrical malfunction. Device (1) according to one of the preceding claims, characterized in that the control device (14) comprises a gate driver (15). Device (1) according to one of the preceding claims, characterized in that the circuit (8) is an integrated circuit, in particular an ASIC. Device (1) according to one of the preceding claims, characterized in that the control unit (20) is a microcontroller which is set up to determine a plurality of vehicle states. A method for protecting at least one safety-relevant electrical system component (2, 3) of a vehicle electrical system, comprising: - providing at least one semiconductor switch (4) which is electrically conductively connected to the at least one electrical system component (2, 3), - Provision of a circuit (8) which is electrically conductively connected to the semiconductor switch (4) and which has a detection device (9) for detecting an electrical malfunction of the vehicle electrical system and a control device (14) for controlling the semiconductor switch (4) - Provision of a control unit (20) which is at least connected to the circuit (8) capable of communication, - characterized in that the semiconductor switch (4) in a first safety state in which the Semiconductor switch (4) is switched off, switches to the electrical system components (2, 3) from electrical overload en to protect, and also depending on a transient second electrical malfunction and at least one predetermined vehicle state is switched to a second safety state in which the semiconductor switch (4) is switched on in order to ensure an availability-relevant supply of the electrical system components (2, 3) , and furthermore the circuit (8) having a malfunction disconnection device (19) forcibly switches the semiconductor switch (4) into the first safety state for about 50 microseconds to about 150 microseconds depending on the detection of a third electrical malfunction. Procedure according to Claim 9 , characterized in that the first safety state or the second safety state are prioritized as a function of the at least one vehicle state. Procedure according to Claim 9 or 10 , characterized in that the semiconductor switch (4) is forcibly switched to the first safety state at least temporarily as a function of the detection of an electrical malfunction. Method according to one of the Claims 9 until 11 , characterized in that a control signal of the circuit (8) is optionally replaced by the control unit (20) depending on the at least one predetermined vehicle state in order to forcibly switch the semiconductor switch (4) at least temporarily to the second safety state. Method according to one of the Claims 10 until 12th , characterized in that, depending on the at least one vehicle state, the first safety state is switched to the second safety state at least once and the first safety state is only switched back to when the same electrical malfunction is detected again.

Images